Loading post…
CloudflareMari GalicerAnnouncement
Building a post-quantum certificate authority with Merkle Tree Certificates
Summary
The Web PKI faces a scaling problem because post-quantum (PQ) signatures are roughly 40 times larger than classical ones, making direct adoption at Internet scale expensive. Merkle Tree Certificates (MTCs) address this by batching certificates into an append-only Merkle tree, allowing a CA to sign the tree root and clients to verify with a compact inclusion proof. Cloudflare is building a certificate authority that will support MTC issuance, targeting early 2027 for inclusion in Chrome’s new Quantum-resistant Root Store, and will offer standard MTC issuance at no cost. The MTC architecture couples issuance with logging (“issue by logging”), making transparency a first-party property rather than an add-on, which reduces redundancy and scaling overhead. Cloudflare successfully completed an experimental deployment with Chrome and is now moving to full production, but notes that broader ecosystem participation from browsers, CAs, and monitors is needed for the transition.
Context
The Web PKI’s current certificate infrastructure cannot efficiently handle the 40x larger signatures required by post-quantum cryptography. Merkle Tree Certificates (MTCs) provide a solution by batching certificates into an append-only Merkle tree, where the CA signs only the tree root and clients verify with compact inclusion proofs. Cloudflare is building a new certificate authority that will issue MTCs, targeting early 2027 for inclusion in Chrome’s Quantum-resistant Root Store. The CA will offer standard MTC issuance at no cost. Cloudflare previously ran a successful experimental deployment with Chrome and is now moving toward production, but the transition requires ecosystem-wide participation from browsers, CAs, mirrors, and monitors.
Approach / What changed
Cloudflare’s CA implements Merkle Tree Certificates (MTCs) as defined by the IETF PLANTS working group. Instead of signing individual certificates, the CA batches certificates into an append-only Merkle tree and signs the tree root. Clients verify a certificate using a compact inclusion proof—a sequence of cryptographic hashes—against a signed tree head. This couples issuance with logging (‘issue by logging’), making transparency a requirement for operation rather than an add-on. The CA also operates mirroring cosigners that store copies of issuance logs, verifying append-only consistency and ensuring log availability. Certificates can be issued in standalone form (with inclusion proof in certificate) or landmark-relative form (using out-of-band tree heads).
Takeaways
PQ signatures are roughly 40 times larger than classical ones, ballooning CT log storage needs by 40x and making direct adoption at Internet scale expensive.
MTCs reduce per-certificate overhead by batching certificates into a Merkle tree, allowing verification via compact inclusion proofs instead of individual PQ signatures.
Cloudflare’s CA will issue MTCs at no cost, targeting early 2027 for Chrome’s root store, but ecosystem participation from multiple CAs, browsers, and monitors is needed.
FAQ
How do MTCs reduce certificate size?
MTCs batch many certificates into an append-only Merkle tree. The CA signs only the tree root, and clients verify a certificate using a compact inclusion proof—a sequence of hashes—instead of a full individual signature. This drastically reduces size overhead compared to using individual PQ signatures.
What does 'issue by logging' mean?
In the MTC ecosystem, issuance and logging are coupled: a certificate is issued by being included in the CA's Merkle tree log, and the inclusion proof serves as the trust anchor. This makes transparency a first-class property of issuance rather than a separate compliance step.
When will Cloudflare's CA support MTCs?
Cloudflare's new CA will support MTC issuance targeting early 2027 for inclusion in Chrome's newly launched Quantum-resistant Root Store. The CA will offer standard MTC issuance at no cost.
Source and freshness
- Source
- blog.cloudflare.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.